To: 


Of: 


ico. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Global One 2015 


4 Gateway Mews, Bounds Green, London, Nii 2UT 


The Information Commissioner (“Commissioner”) has decided to issue 
Global One 2015 (“Global One”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is in relation 
to a serious contravention of Regulation 22 of the Privacy and 
Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


Global One, whose registered office is given above (Companies House 
Registration Number: 07517992) is the organisation stated in this 
notice to have instigated the transmission of unsolicited 
communications by means of electronic mail to individual subscribers 


for the purposes of direct marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 


5; 
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Regulation 23 of PECR states that “A person shall neither transmit, nor 


instigate the transmission of, a communication for the purposes of 


direct marketing by means of electronic mail - 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 


communications cease has not been provided; 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 


Section 122(5) of the DPA 2018 defines “direct marketing” as “the 
communication (by whatever means) of any advertising material which 
is directed to particular individuals”. This definition also applies for the 


purposes of PECR. 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


10. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


Section 55A of the DPA (as amended by the Privacy and Electronic 
Communications (EC Directive)(Amendment) Regulations 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 


of the DPA about the issuing of monetary penalties that has been 
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published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 


that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


Phone users can report the receipt of unsolicited marketing text 
messages to the GSMA’s Spam Reporting Service by forwarding the 
message to 7726 (spelling out “SPAM”). The GSMA is an organisation 
that represents the interests of mobile operators worldwide. The 
Commissioner is provided with access to the data on complaints made 
to the 7726 service and this data is incorporated into a Monthly Threat 


Assessment (MTA) used to ascertain organisations in breach of PECR. 


Global One operates as a charity involved in issues such as improving 
health, sanitation and agriculture. Their work covers a number of 
international countries, including the United Kingdom. Global One is 
registered with the Charity Commission, Companies House and the 
ICO. 
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Global One came to the attention of the Commissioner after numerous 
complaints were received via the 7726 complaints tool about 
unsolicited text messages. Between 30 April 2020 and 22 May 2020 
539 complaints had been recorded on the 7726 system and 9 on the 
ICO’s online recording tool. These text messages contained, or 


contained slight variations of, the following text: 


“Coronavirus Emergency Pakistan, Syria &amp; Bangladesh. Donate Food 
&amp; Hygiene Kits. Call (free): 03000113333 Online: globalone.org.uk 
Watch us live on SKY 752.” 


It was noted that these texts did not offer individuals an ability to ‘opt- 


out’ of future unsolicited text messages. 


An initial investigation letter was sent to Global One on 3 June 2020, 
highlighting the Commissioner’s concerns with its PECR compliance and 
requesting information relating to the volumes of texts sent, the source 
of data used to send said texts, details of any due diligence 
undertaken, together with evidence of consent relied upon for the 
messages sent to individuals identified within complaints. An appendix 


detailing the complaints received was also attached. 


Global One provided a response on 22 June 2020, stating that on 20 
March 2020 it had entered into a “revenue raising and sharing 
agreement” (“the agreement”) with x E 
under which WE would provide a marketing strategy in relation to a 
number of key initiatives. Global One went on to explain that under the 
agreement they “will have no right nor will seek to exercise any 
direction, control or supervision over EE; and that aa 
has the sole right to control and direct the means, manner and method 


by which the services required by the Agreement would be performed”. 
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A copy of the agreement later provided by Global One makes no 


mention of SMS marketing, however the agreement is summarised as 


follows: 


“The charity intends to procure iE 2s 


consultant/advisers to develop and execute a revenue sharing 
agreement, which will raise funds from public donations and allow the 
charity to enhance and apply for more institutional funding. The charity 


wishes to diversify its fundraising income streams”. 


The letter went on to state that on 23 April 2020 || informed Global 
One that it would be undertaking an SMS campaign to maximise 
donations, which Global One says it assumed would be based on the 


use of third-party marketing lists belonging to E. 


Global One advised that between April 2020 and May 2020, 573,000 
SMS marketing messages were sent on its behalf. During this period, 
| | managed the SMS marketing campaign, and Global One say it only 
became aware on 1 June 2020 that J had entered into a verbal 
contract with a third party data supplier who undertook the sending of 
the SMS using a marketing list belonging to that supplier. 


In response to the Commissioner’s request for evidence of consent to 
send SMS messages to those who had been identified on the list of 
complaints, Global One said it had not been provided this information 
from | and would need to approach = to obtain this. In a further 
response dated 23 July 2020 Global One provided the following 


information: 


a have confirmed that they commissioned the [third party 
provider] to deliver the text messaging campaign. 


25. 
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The [third party provider], have confirmed in writing that the lists they 
use are fully compliant data, please see the attached letter and 
accompanying spreadsheet with their comments.” 
The attached letter indicated that the data is obtained from multiple 
sources including “government records, licensing boards, directories, 
telephone searches, memberships, attendee registers, website 
registrations, county courthouse records, credit reference agency data, 
Secretary of State data, business magazines and newspaper 
subscriptions”. The spreadsheet of complaints provided by the 
Commissioner had been amended to add a new column titled “Consent” 
and the words “opt in for third party marketing” next to each 


complainant. 


On 21 August 2020 the Commissioner requested that Global One 
provide evidence of the consent that had been obtained by the third 
party data provider to market the complainants. In response, Global 
One explained that it did not have access to this information and the 
third party provider was reluctant to supply it. As such, no evidence of 


consent has been provided. 


The Commissioner went on to request copies of correspondence 
between Global One, ff and the third party data provider relating to 
promotional or marketing activities. On 27 August 2020 Global One 
replied, stating that they had been unable to locate any such written 
communications regarding the SMS marketing campaign which was 
carried out on their behalf. The reason given was that all such 


communications were conducted by telephone. 


Enquiries raised by the Commissioner directly with I elicited the 


following response: 


28. 
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M j- aware of the current investigation being conducted by 
the ICO in relation to one of our clients, Global One 2015. Other than 
providing strategic recommendations on how to deliver charitable 
appeal campaigns, we have done nothing more than advice/refer a 
client onto various other agencies/companies to support them in being 
able to reach a wider audience. We in this situation are not responsible 
for due diligence or any contractual obligations for any work Global One 


decide to undertake with any third party.” 


In subsequent Representations to the Notice of Intent however, Global 
One evidenced an email from ie. od in which the contrary was 
stated: “we undertook our responsibility to carry out due diligence on 
the provider HY”. This statement was made in response to 
enquiries made of ii by Global One dated 1 June 2020, and 
which post-dated the SMS campaign. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 

The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by Global One and, if so, 
whether the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that Global One contravened regulations 22 
and 23 of PECR. 


The Commissioner finds that the contravention was as follows: 


32. 


33. 
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36. 
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Between 24 April 2020 and 23 May 2020 Global One instigated the 
transmission of 573,000 unsolicited direct marketing texts contrary to 
Regulations 22 & 23 of PECR. This resulted in a total of 539 complaints 
being received via the 7726 service and 9 via the Commissioner’s 


online reporting tool. 


Global One, as the instigator of the direct marketing, is required to 
ensure that it is acting in compliance with the requirements of 
regulation 22 of PECR, and to ensure that valid consent to send those 
messages had been acquired. The only exception to this is where the 
provisions of Regulation 22(3) apply, otherwise referred to as the ‘soft 
opt-in’. As a charitable organisation, the ‘soft opt-in’ would not be 


applicable in this instance. 


Global One relied on consent obtained by another organisation for its 
Own purposes, i.e. ‘indirect consent’. The Commissioner’s direct 
marketing guidance says “organisations need to be aware that indirect 
consent will not be enough for texts, emails or automated calls. This is 
because the rules on electronic marketing are stricter, to reflect the 


more intrusive nature of electronic messages.” 


It goes on to say that indirect consent can be valid but only if it is clear 
and specific enough. Moreover, “the customer must have anticipated 
that their details would be passed to the organisation in question, and 
that they were consenting to messages from that organisation. This will 


depend on what exactly they were told when consent was obtained”. 


The data lists utilised to transmit the SMS had been compiled from a 
diverse list of sources. Whilst the third party data provider stated that 
each complainant was “opted-in for third party marketing” Global One 
has not provided any evidence of this to the Commissioner and appears 


to have been reliant on the | verbal assurances that this was the 
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case. In representations to the Commissioner, Global One 


demonstrated that some due diligence enquiries had been made of J 
GE in carly June 2020, however these post-dated the 


. contravention and were insufficient to establish the existence of valid 


consent to send the SMS. 


The Commissioner is therefore satisfied from the evidence she has 
seen that Global One did not have the necessary valid consent to 
instigate the sending of the direct marketing messages. This 


constitutes a contravention of regulation 22 PECR. 


Furthermore, Regulation 23(b) provides that individuals must be 
provided with a valid address to which the recipient of the marketing 
communication may send a request to refuse marketing. In 
representations to the Commissioner, Global One stated that it had an 
effective complaints process in place whereby any complaints it 
received directly would be sent to SS in order that the data 
could be supressed. (MM was said to deal with their own 
requests. The Commissioner finds it difficult to accept that B 
were in any position to handle direct requests, given that recipients of 
SMS were unaware of ls involvement and were not provided with 
contact details. Although the content of the messages identified Global 
One and contained a link to their website, no address has been 
provided for the third party who sent the messages. As Global One 
were unaware that a third party was the sender of the messages 
during the SMS marketing campaign, individuals informing Global One 
that they objected to receiving such communications would have been 
reliant upon Global One relaying these to MJ, and then in turn 
to the third party sender, and so in effect produced a convoluted, 
unreliable and therefore ineffectual remedy. As such the Commissioner 


considers that Global One are also in breach of Regulation 23. 
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The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 
above was serious. This is because between 24 April 2020 and 23 May 
2020 Global One instigated a total of 573,000 unsolicited direct 


marketing messages, resulting in total of 548 complaints. 


In representations to the Notice of Intent, Global One stated that it had 
been the subject of a social media campaign of harassment, and SMS 
recipients encouraged to make complaints against Global One. Details 
provided to the Commissioner by way of evidence demonstrated that 
any such campaign (in relation to which the Commissioner makes no 
finding) post-dated the contravention period and so the Commissioner 


finds no good reason to disregard the complaints as disingenuous. 


Global One has failed to provide evidence of valid consent for any of 


the 573,000 unsolicited direct marketing messages it instigated. 


Furthermore, the messages did not contain adequate instruction on 


how individuals may opt-out of receiving further marketing. 


It is apparent that Global One adopted a targeted strategy in order 
both to raise their profile and increase their revenue stream during the 


Covid-19 pandemic. 
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The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that Global One did not deliberately set 


out to contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether Global One knew or ought 
reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
not least since the issue of unsolicited text messages have been widely 


publicised by the media as being a problem. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 

This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations 
can generally only send, or instigate, marketing messages to 
individuals if that person has specifically consented to receiving them. 
The guidance is also clear about the significant risks of relying on 


indirect consent, as Global One did in this instance. 
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In 2018 the charity sector came under much scrutiny following 
investigations and penalties in respect of contraventions of PECR. 
These investigations were well publicised at the time, receiving much 
media attention and further engagement with the Charity Commission 
and the ICO, including conferences to the third sector to highlight the 
issues and promote compliance. The introduction of the Fund Raising 
Preference Service in 2016 also provides advice and support to 
charities with the aim of making it easier for them to understand the 


standards expected when fundraising. 


It is therefore reasonable to suppose that Global One should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether Global 
One failed to take reasonable steps to prevent the contraventions. 


Again, she is satisfied that this condition is met. 


During the course of the Commissioner’s investigation, responses 
provided by Global One indicated that they were aware that proper due 
diligence should have been undertaken prior to entering into the 
agreement with E. however due to time constraints no due diligence 
was conducted, stating: “under normal circumstances we would have 
had further meetings to fully review contractual terms and conduct 
proper due diligence with regards to databases and compliance, 
regrettably this was not the case”. Global One instead relied on verbal 


assurances provided by E. 


Reasonable steps which the Commissioner might expect in these 
circumstances could have included ensuring a comprehensive contract 
was in place with I relating to the marketing campaign and the 


provision of the data to be relied upon, to ensure its reliability and 
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validity. Global One failed to provide any evidence of communications 
between itself and B regarding the SMS marketing campaign, other 
than to say the matter was discussed and concluded in two telephone 
meetings with J. Failure to formalise the obligation of due diligence 
also led to conflicting evidence during the investigation and subsequent 
representations as to which party was thought to be responsible. There 


was a Clear lack of control over a direct marketing campaign launched 
at their instruction to E. 


Global One did later ask i) for evidence of consent, but only after 
commencement of the campaign, and after it had received complaints 
directly in early May 2020. At that point Global One took no action to 
pause or suspend the campaign whilst enquiries were made. Even then 
Global One continued to rely upon Is assurances without any actual 
evidence of consent. Whilst Global One did attempt to undertake some 
due diligence in early June 2020, it was only after it became aware that 
the leads were supplied by a third party, and at the end of the 
campaign in question. It would have been reasonable for Global One 
to carry out its own checks as to how consent was being obtained prior 
to instigating the SMS campaign, notwithstanding any assurances by 
E. In short, simple reliance on assurances of indirect consent alone 


without undertaking proper due diligence is not acceptable. 


In the circumstances, the Commissioner is satisfied that Global One 


failed to take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


59. 


60. 


61. 


62. 


63. 


64. 


65. 


ico. 


Information Commissioner's Office 


The Commissioner’s decision to impose a monetar enalt 


The Commissioner finds that there are no aggravating features of 


this case. 


The Commissioner has taken into account the following mitigating 


features of this case: 


e Since the commencement of the Commissioner’s investigation 
Global One has ceased all direct marketing activities and is 


undertaking a full review of its data protection compliance. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


This has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking, and invited Global One 


2015 to make representations in response. 


The Commissioner has received and considered Representations in 
response to the Notice of Intent dated 30 April 2021. 


The Commissioner is accordingly entitled to issue a monetary penalty in 


this case. 


The Commissioner has considered whether, in the circumstances, she 
should exercise her discretion so as to issue a monetary penalty. She 


has decided that a monetary penalty is an appropriate and proportionate 
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response to the finding of a serious contravention of regulations 22 and 
23 of PECR by Global One. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The instigation or 
making of unsolicited direct marketing texts is a matter of significant 
public concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only texting 


consumers who want to receive these messages. 


The Commissioner has also considered the likely impact of a monetary 
penalty on Global One and in doing so has reviewed financial evidence 


supplied alongside its representations. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided that 


the amount of the penalty is £10,000 (Ten thousand pounds). 


Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 15 July 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 
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70. Ifthe Commissioner receives full payment of the monetary penalty by 
14 July 2021 the Commissioner will reduce the monetary penalty by 
20% to £8,000 (Eight thousand pounds). However, you should be 
aware that the early payment discount is not available if you decide to 


exercise your right of appeal. 


71. There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


a) the imposition of the monetary penalty 


and/or; 


b) the amount of the penalty specified in the monetary penalty 


notice. 


70. Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 


71. Information about appeals is set out in Annex 1. 


72. The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary penalty 
must be paid has expired and all or any of the monetary penalty has 


not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e period for appealing against the monetary penalty and any variation of 


it has expired. 
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73. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner 
as an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 14th day of June 2021 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a right 
of appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 
against the notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in accordance 
with the law; or 


b) tothe extent that the notice involved an exercise of discretion by the 
Commissioner, that she ought to have exercised her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as could 
have been made by the Commissioner. In any other case the Tribunal will 
dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


GRC & GRP Tribunals 
PO Box 9300 
Arnhem House 

31 Waterloo Way 
Leicester 

LE1 8DJ 


a) The notice of appeal should be sent so it is received by the Tribunal 
within 28 days of the date of the notice. 
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If your notice of appeal is late the Tribunal will not admit it unless the 


Tribunal has extended the time for complying with this rule. 


4, 


5. 


The notice of appeal should state: - 


a) your name and address/name and address of your representative 
(if any); 


b) an address where documents may be sent or delivered to you; 
c) the name and address of the Information Commissioner; 

d) details of the decision to which the proceedings relate; 

e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 
monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the notice 
of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 


solicitor or another adviser. At the hearing of an appeal a party may conduct 
his case himself or may be represented by any person whom he may 
appoint for that purpose. 


6. 


The statutory provisions concerning appeals to the First-tier Tribunal 


(Information Rights) are contained in sections 48 and 49 of, and Schedule 6 
to, the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 
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